From 2078f3dd2e9c30258dedeffb5d4a84c5c7fd8879 Mon Sep 17 00:00:00 2001 From: Satya Rama Aditya Pinapala Date: Thu, 25 Jul 2019 10:56:51 -0700 Subject: [PATCH] disp: msm: sde: add check before buffer copy This change adds a check for the length of the buffer before copying it to avoid a buffer overflow. Change-Id: I9af9d422e0b3cf02c8d6662af3310337a9861a7a Signed-off-by: Satya Rama Aditya Pinapala --- msm/sde/sde_connector.c | 1 + msm/sde_rsc.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/msm/sde/sde_connector.c b/msm/sde/sde_connector.c index 844d2b8590..9900ce8c56 100644 --- a/msm/sde/sde_connector.c +++ b/msm/sde/sde_connector.c @@ -1698,6 +1698,7 @@ static ssize_t _sde_debugfs_conn_cmd_tx_sts_read(struct file *file, return 0; } + blen = min_t(size_t, MAX_CMD_PAYLOAD_SIZE, count); if (copy_to_user(buf, buffer, blen)) { SDE_ERROR("copy to user buffer failed\n"); return -EFAULT; diff --git a/msm/sde_rsc.c b/msm/sde_rsc.c index 0a70621916..79e385c0a2 100644 --- a/msm/sde_rsc.c +++ b/msm/sde_rsc.c @@ -1102,6 +1102,7 @@ end: if (blen <= 0) return 0; + blen = min_t(size_t, MAX_BUFFER_SIZE, count); if (copy_to_user(buf, buffer, blen)) return -EFAULT; @@ -1195,6 +1196,7 @@ end: if (blen <= 0) return 0; + blen = min_t(size_t, MAX_BUFFER_SIZE, count); if (copy_to_user(buf, buffer, blen)) return -EFAULT;